diff --git a/publish.sh b/publish.sh
index d537d7c..a86cc34 100755
--- a/publish.sh
+++ b/publish.sh
@@ -3,6 +3,14 @@
 semver=${1:-patch}
 
 set -e
+
+# In CI, NPM_TOKEN is injected as an env var (Jenkins secret / GitHub Actions secret).
+# Write it to ~/.npmrc so npm publish can authenticate without interactive login.
+# For local publishing, this block is skipped and your existing `npm login` session is used.
+if [ -n "$NPM_TOKEN" ]; then
+  echo "//registry.npmjs.org/:_authToken=${NPM_TOKEN}" > ~/.npmrc
+fi
+
 npm run build
 npm --no-git-tag-version version ${semver}
 npm publish --access public